name: ci

on:
  push:
    tags: ["**"]
  pull_request:

jobs:
  rust:
    name: cargo check + cargo test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: System deps (cpal / Opus / SQLite / SDL2)
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libasound2-dev libpulse-dev pkg-config \
            libdbus-1-dev \
            libsdl2-dev \
            libopus-dev
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: cargo check --workspace
        run: cargo check --workspace --locked
      - name: cargo test --workspace
        env:
          # Storage tests must not hit the real OS keyring on CI:
          # there is no D-Bus session available and the call would
          # block. The runtime code carries the same toggle for
          # headless / sandboxed environments.
          CHANORA_DISABLE_KEYRING: "1"
        run: cargo test --workspace --locked --no-fail-fast
      - name: cargo clippy
        run: cargo clippy --workspace --all-targets -- -D warnings
        continue-on-error: true

  supply-chain:
    name: cargo deny (licenses + advisories + bans + sources)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: EmbarkStudios/cargo-deny-action@v2
        with:
          command: check
          # `licenses` enforces the DEC-020 license posture; the
          # other three are minimal supply-chain hygiene per
          # `docs/governance/legal-review-readiness.md` §5.
          arguments: --workspace --all-features

  license-inventory:
    name: cargo about (license inventory)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Install cargo-about
        run: cargo install --locked --features cli cargo-about
      - name: Regenerate inventory and compare
        # Build the inventory in a temp file and diff against the
        # committed copy. CI fails when the committed inventory is
        # stale, forcing contributors to run the tool locally
        # before opening a PR that touches the dependency tree.
        run: |
          cargo about generate --output-file /tmp/license-inventory.md about-md.hbs
          diff docs/security/license-inventory.md /tmp/license-inventory.md \
            || { echo "::error::docs/security/license-inventory.md is stale; regenerate with 'cargo about generate --output-file docs/security/license-inventory.md about-md.hbs'"; exit 1; }

  flutter-license-inventory:
    name: flutter license inventory
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: subosito/flutter-action@v2
        with:
          channel: stable
      - name: flutter pub get
        working-directory: apps/chanora_flutter
        run: flutter pub get
      - name: Regenerate Flutter license inventory and compare
        env:
          # Resolved by the wrapper from $HOME/sdks/flutter when
          # not set; CI's subosito/flutter-action puts flutter on
          # PATH but exports the SDK root under FLUTTER_ROOT.
          FLUTTER_ROOT: ${{ env.FLUTTER_ROOT }}
        run: |
          ./tools/dump_flutter_licenses.sh
          if ! git diff --quiet docs/security/flutter-license-inventory.md; then
            echo "::error::docs/security/flutter-license-inventory.md is stale; regenerate with 'tools/dump_flutter_licenses.sh'"
            git --no-pager diff docs/security/flutter-license-inventory.md | head -40
            exit 1
          fi

  flutter:
    name: flutter analyze
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: subosito/flutter-action@v2
        with:
          channel: stable
      - name: flutter pub get
        working-directory: apps/chanora_flutter
        run: flutter pub get
      - name: flutter analyze
        working-directory: apps/chanora_flutter
        run: flutter analyze
      - name: flutter test (unit only)
        working-directory: apps/chanora_flutter
        run: flutter test --exclude-tags e2e

  flutter-ios-release-build:
    name: flutter iOS unsigned release build
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4
      - uses: subosito/flutter-action@v2
        with:
          channel: stable
      - name: Try to fetch local SileroCoreML package
        run: git submodule update --init --depth=1 silero-coreml || true
      - name: flutter pub get
        working-directory: apps/chanora_flutter
        run: flutter pub get
      - name: Check local SileroCoreML package
        id: silero-coreml
        run: |
          if [ -f silero-coreml/Package.swift ]; then
            echo "available=true" >> "$GITHUB_OUTPUT"
          else
            echo "::notice::Skipping iOS build because silero-coreml submodule is not available"
            echo "available=false" >> "$GITHUB_OUTPUT"
          fi
      - name: flutter build ios --no-codesign
        if: steps.silero-coreml.outputs.available == 'true'
        working-directory: apps/chanora_flutter
        run: flutter build ios --release --no-codesign